Attachment A, Board Date 02/27/18, Page 1 of 9

Transcription

1 Attachment A, Board Date 02/27/18, Page 1 of 9 Orange County Auditor-Controller Internal Audit Quarterly Internal Audit Activity Status Report: October through December 2017 Project Number Report Date: February 27, 2018

2 Attachment A, Board Date 02/27/18, Page 2 of 9 O R A N G E C O U N T Y AUDITOR CONTROLLER I N T E R N A L A U D I T Eric H. Woolery, CPA Orange County Auditor Controller Assistance in assembling this report provided by: Scott Suzuki, CPA, CIA, CISA Nancy Ishida, CPA, CIA, CISA Carol Swe, CPA, CIA, CISA Director, Internal Audit Senior Audit Manager III Senior Audit Manager II 12 Civic Center Plaza, Room 200 Santa Ana, CA Auditor Controller Web Site

3 Attachment A, Board Date 02/27/18, Page 3 of 9

4 QUARTERLY INTERNAL AUDIT ACTIVITY STATUS REPORT Audit Projects: Executive Summary Attachment A, Board Date 02/27/18, Page 4 of 9 B. First Follow-Up Revenue Generating Lease Audit: OC Community Resources/OC Parks David L. Baker Golf Course Concession (Audit No B). A-C/IAD completed a First Follow-Up Revenue Generating Lease Audit of the concession agreement between the County of Orange and CF David L. Baker Arcis LLC (Arcis) for the operation of a golf course, driving range, snack bar, and pro shop located at the County s Mile Square Regional Park. The audit was limited to reviewing the actions taken as of May 31, 2017, to implement the six recommendations from the original audit report dated October 11, The First Follow-Up Audit found that OC Community Resources/OC Parks implemented two recommendations and the remaining four recommendations are in process. C. Compliance Monitoring of the Treasurer s Investment Portfolio for the Quarter Ended September 30, 2017 (Audit 1720). At the request of the Treasury Oversight Committee, A- C/IAD performed the Compliance Monitoring of the Treasurer s Investment Portfolio for the quarter ended September 30, 2017 to determine whether the Office of the Treasurer-Tax Collector complied with specified provisions of the Investment Policy Statement (IPS). No instances of non-compliance were identified. D. Internal Control Audit: Countywide Audit of County Business Travel and Meeting Policy Registrar of Voters (Audit 1626-F). As part of a Countywide Audit of the County Business Travel and Meeting Policy, A-C/IAD completed an audit of internal controls over Registrar of Voters expenditures governed by the County Business Travel and Meeting Policy for the fiscal year (FY) ended June 30, The audit objectives were to: (1) evaluate operational effectiveness of internal control for expenditures governed by the County Business Travel and Meeting Policy to ensure expenditures are complete accurate, and valid; (2) determine whether expenditures are made in compliance with the County policy; and (3) review travel and meeting expenditure business processes for efficiency improvement. A- C/IAD identified six Control Findings regarding a lack of policies and procedures for business travel and meeting expenditures, inadequate segregation of duties, exceeded Cal- Card purchase limits, non-use of the Business Meeting Policy Certification Form, incorrect type of Cal-Card used for certain purchases and non-cancellation of supporting documents. E. First Follow-Up Audit: Management Letter on Review of the Schedule of Assets Held by the County Treasury (Audit 1727-A). A-C/IAD completed a First Follow-Up Audit of the Management Letter on Review of the Schedule of Assets Held by the County Treasury as of September 30, The audit was limited to reviewing the actions taken as of November 30, 2017, to implement the one recommendation from the original audit report dated May 31, The First Follow-Up Audit found that the one recommendation is currently in process.

5 Attachment A, Board Date 02/27/18, Page 5 of 9 New Audit Findings & Recommendations by Risk Category Critical Control Weaknesses These are audit findings or a combination of audit findings that represent critical exceptions to the audit objective(s) and/or business goals. Management is expected to address Critical Control Weaknesses brought to their attention immediately. No Critical Control Weakness/Material Weakness issued during October through December Audit Recommendation issued for FY Material Weaknesses is the terminology used for critical control weaknesses identified in audits conducted under AICPA Attestation Standards. Significant Control Weaknesses These are audit findings or a combination of audit findings that represent a significant deficiency in the design or operation of internal controls. Significant Control Weaknesses generally will require prompt corrective actions. No Significant Control Weakness issued during October through December Audit Recommendation issued for FY Control Findings These are audit findings concerning internal controls, compliance issues, or efficiency issues that require management s corrective action to implement or enhance processes and internal controls. Control Findings are expected to be addressed within our followup process of six months, but no later than twelvemonths. Six (6) Control Findings/Control Deficiencies issued during October through December Audit Recommendations issued for FY Control Deficiency is the terminology used for control findings identified in audits conducted under AICPA Attestation Standards. Total Audit Recommendations for FY : 40

6 Attachment A, Board Date 02/27/18, Page 6 of 9 B. DEPT: OC Community Resources TITLE: First Follow-Up Revenue Generating Lease Audit: OC Community Resources/OC Parks David L. Baker Golf Course Concession AUDIT NO.: 1642-B (Reference No.:1559-F1) ISSUED: October 5, 2017 Scope: We performed a First Follow-Up Revenue Generating Lease Audit of OC Community Resources (OCCR)/OC Parks David L Baker Golf Course Concession. Our audit was limited to reviewing actions taken as of May 31, 2017, to implement the six (6) recommendations from our original audit dated October 11, Conclusion: Our First Follow-Up Audit found that David L. Baker Arcis LLC (Arcis) implemented two recommendations and is in the process of implementing four recommendations. Background: The David L. Baker Golf Course Concession lease was assigned to Arcis on September 16, 2014 and extends through April 30, The agreement is for the operation of a golf course, driving range, snack bar, and pro shop located at the Orange County s Mile Square Regional Park. The main purpose of the original audit was to determine whether Arcis records adequately supported its monthly gross receipts and rent paid to the County. Recommendations: Four recommendations remain open: that OCCR: (1) determine if consumption of alcoholic beverages is acceptable out on the golf course; (2) require Arcis to utilize prenumbered agreements for banquets, room rentals, and tournaments; (3) ensure Arcis submits required financial statements in a timely manner and in compliance with the agreement; and (4) obtain, review, and reconcile David L. Baker s Concession s annual financial statements in a timely manner remain open.

7 Attachment A, Board Date 02/27/18, Page 7 of 9 C. DEPT: Treasurer-Tax Collector TITLE Compliance Monitoring of the Treasurer s Investment Portfolio for the Quarter Ended September 30, 2017 AUDIT NO.: 1720 ISSUED: November 28, 2017 Scope: We completed the Compliance Monitoring of the Treasurer s Investment Portfolio for the quarter ended September 30, The purpose of our engagement was to determine whether the Office of the Treasurer-Tax Collector complied with specified provisions of the Investment Policy Statement (IPS). Background: We conduct our Compliance Monitoring of the Treasurer s Investment Portfolio at the request of the Treasury Oversight Committee. This engagement is intended to provide assurance to the Board of Supervisors, the County Executive Officer, Treasury Oversight Committee, and other stakeholders that the Treasurer s investment portfolio complies with specific provisions of the IPS and that non-compliance deficiencies or technical incidents and required disclosures are properly reported. Our procedures included selecting five business days per month for validating whether investment purchases complied with the IPS by reviewing and testing supporting documentation. Conclusion: Based on our compliance monitoring for the selected dates, no instances of noncompliance were identified. Recommendations: None.

8 Attachment A, Board Date 02/27/18, Page 8 of 9 D. DEPT: Registrar of Voters TITLE: Internal Control Audit: Countywide Audit of County Business Travel and Meeting Policy Registrar of Voters AUDIT NO.: 1626-F ISSUED: December 5, 2017 Scope: As part of a Countywide Audit of the County Business Travel and Meeting Policy, we have completed our audit of internal controls of Registrar of Voters (ROV) expenditures governed by the County Business Travel and Meeting Policy (Travel Policy) for the fiscal year ended June 30, Our audit objectives were to: (1) evaluate operational effectiveness of internal control for expenditures governed by the Travel Policy to ensure expenditures are complete, accurate, and valid; (2) determine whether expenditures are made in compliance with the County policy; and (3) review travel and meeting expenditure business processes for efficiency improvement. Conclusion: (1) We found that internal control is generally effective to ensure that expenditures governed by the Travel Policy are complete, accurate, and valid; however, we noted two Control Findings regarding a lack of policies and procedures for business travel and meeting expenditures and inadequate segregation of duties. (2) We found that expenditures are generally made in compliance with County policy; however, we noted four Control Findings where the Cal-Card single purchase limit was exceeded for purchase of items under existing contract, the Business Meeting Policy Certification form was not used, the incorrect Cal-Card type was selected for certain transactions, and supporting documentation was not canceled. (3) We found that business processes are generally efficient as related to the process of incurring travel and meeting expenditures. Background: ROV is responsible for conducting elections in the County of Orange. ROV is responsible for all components of election management including voter registration, poll worker and polling place recruitment, ballot creation, voting system security, ballot processing and vote tallying, community outreach and education, and candidate services. On January 26, 2016, the Board approved Resolution , the Travel Policy, to ensure the County s resources are spent in a manner that maximizes and provides full accountability of those resources, and provides for reasonable and equitable reimbursement of expenses incurred by individuals while on County business travel. Recommendations: We recommend ROV: develop detailed policies and procedures regarding business travel and meeting expenditures; ensure revolving fund purchases are approved by an authorized person who does not have revolving fund custodian, check signer, or reconciliation duties; ensure single purchase limits are not exceeded and that Cal-Cards are not used to purchase items under existing contract; ensure a Business Meeting Policy Certification form is completed and approved for all business meeting expenditures; ensure each Cal-Card type is only used for authorized purposes; and ensure supporting documentation for travel expenditures is properly canceled (marked as paid ).

9 Attachment A, Board Date 02/27/18, Page 9 of 9 E. DEPT: Treasurer-Tax Collector TITLE: First Follow-Up Audit: Management Letter on Review of the Schedule of Assets Held by the County Treasury as of September 30, 2016 AUDIT NO.: 1727-A (Reference 1612-F1) Scope: We performed a First Follow-Up Audit of the Management Letter on Review of the Schedule of Assets Held by the County Treasury as of September 30, Our audit was limited to reviewing actions taken as of November 30, 2017, to implement the one recommendation from our original audit report dated May 31, Conclusion: Our First Follow-Up Audit found that Treasurer-Tax Collector is in the process of implementing the one recommendation from the original audit. Background: In performing our Review of the Schedule of Assets Held by the County Treasury as of September 30, 2016, we identified one issue we determined to be a reportable condition which was included in the original management letter, issued May 31, Recommendations: Our one recommendation remains open that Treasurer-Tax Collector management ensure its financial records accurately reflect the cash and investment accounts of the Treasury. ISSUED: December 19, 2017